Advanced file carving - SANS Computer Forensics
Advanced file carving - SANS Computer Forensics
Advanced file carving - SANS Computer Forensics
You also want an ePaper? Increase the reach of your titles
YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.
FAT File Allocation<br />
FAT File System Structures<br />
Root Directory Entries<br />
File name<br />
_eleted.doc 102<br />
Bla.txt 106<br />
Archive.pst 110<br />
Star7ng block<br />
FAT<br />
Block Next<br />
Index Block<br />
101 Free<br />
102 Free<br />
103 Free<br />
104 Free<br />
105 Free<br />
106 107<br />
107 EOF<br />
108 Free<br />
109 Free<br />
110 111<br />
Media Data Block Area<br />
Bla.txt<br />
101 102 103 104 105 106 107 108 109 110<br />
Contents of the<br />
Deleted.doc <strong>file</strong><br />
still exists on<br />
media<br />
Deleted.doc
Change language